CVE-2024-49576: Use After Free
A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a checkbox CBFWidget object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49576?
CVE-2024-49576 is classified as a critical vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2024-49576?
To fix CVE-2024-49576, update to the latest version of Foxit Reader as soon as the patch is available.
What impact can CVE-2024-49576 have on my system?
CVE-2024-49576 can lead to memory corruption and allow attackers to execute arbitrary code on the affected system.
Is CVE-2024-49576 exploitable through malicious PDF files?
Yes, CVE-2024-49576 is exploitable via specially crafted JavaScript code embedded in malicious PDF documents.
What versions of Foxit Reader are affected by CVE-2024-49576?
CVE-2024-49576 affects Foxit Reader version 2024.3.0.26795 and potentially earlier versions.